WILSON ELSER 

WILSON ELSER MOSKOWITZ EDELMAN & DICKER LLP 


July 17, 2017 Lindsa y B - Nickle 

J 214.698.8093 (direct) 

Lindsay.Nickle@wilsonelser.com 


Via email to Idtheft@oag.state.md.us 

Attorney General Brian E. Frosh 
Office of the Attorney General 
Identity Theft Unit 
200 St. Paul Place 
Baltimore, MD 21202 

Re: Data Security Incident 

Dear Attorney General Frosh: 

We represent Rose Harrison & Gilreath, P.C., a law firm in Kill Devil Hills, North Carolina (“Rose 
Harrison”), with respect to a recent potential data security incident described in more detail below. Rose 
Harrison takes the security and privacy of the information in its control very seriously, and has taken steps 
to prevent a similar incident from occurring in the future. 

1. Nature of the security incident. 

On May 12, 2017, Rose Harrison discovered that one email account had been compromised as a result of 
a phishing email scam. Rose Harrison immediately began an investigation to determine what information 
may have been at risk. As a result of the investigation, Rose Harrison discovered that emails in the 
compromised account may have been inadvertently redirected to an unknown third party. After a detailed 
review of the potentially impacted emails, Rose Harrison determined that the redirected emails may have 
contained client information, including names, addresses, social security numbers, and financial account 
information. 

2. Number of Maryland residents affected. 

A total of 2 residents of Maryland were potentially affected by this security incident. Notification letters 
to these individuals were sent by first class mail on July 17, 2017. A sample copy of the notification letter 
is included with this letter. 

3. Steps taken relating to the incident. 

Rose Harrison takes the security of all information in its systems very seriously, and has taken steps to 
prevent a similar event from occurring in the future. In addition to our continued and ongoing use of a 
retained vendor to monitor and update our system security software, since this event, we have provided 
additional staff training and now require email passwords to be changed by each user every 60 days. 
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Rose Harrison is also offering potentially impacted individuals credit monitoring and identity theft 
protection services for one year, at no cost to the individual, through Identity Fraud, Inc. 

4. Contact information. 

Rose Harrison remains dedicated to protecting the sensitive information in its control. If you have any 
questions or need additional information, please do not hesitate to contact me at (214) 698-8093 or 
Lindsav.Nickle@wilsonelser.com . 

Please let us know if you have any questions. 


Best regards, 

Wilson Elser Moskowitz 

Edelman & Dicker LLP 



Lindsay B. Nickle 


Enclosure 
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700 Blue Jay Street 
Suite 1 


Rose Harrison & Gilreath, P.G. 


Kill Devil Hills, NC 27948 
Tel (252)480-1414 

Fax (252)480-1765 


July 17, 2017 


outerbankslaw.com 


«Name» 

«AddrJ_1» «Addr_L2» 

«City», «State» «Zip» 

Dear «Name»: 

We are writing to inform you of a recent event that may have resulted in the disclosure of your personal 
information. We take the security of all personal information in our possession very seriously, and we 
sincerely apologize for any inconvenience this event may cause. This letter contains information about 
steps you can take to protect yourself and resources we are making available to assist you. 

On May 12, 2017, we discovered that one of our internal email accounts had been compromised as a 
result of a phishing scam. We have conducted an investigation and determined that an email containing 
your social security number and bank account information sent to this email account was inadvertently 
redirected to an unknown third party. Since discovering this incident, we have secured the email account 
in question and have implemented additional security measures designed to help prevent an incident like 
this from occurring again in the future. 

While we are unaware of any misuse of your information, we want to take as many steps as we can to make 
sure that does not happen. We are including information with this letter about steps you can take to 
protect yourself. Also, we have contracted with Identity Fraud, Inc. to provide the following identity 
protection benefits to you for one year, free of charge: 

• Toll-free access to the Identity Fraud Inc. hotline at 1-866-4-IDFRAUD (1-866-443-3728) for 
questions you may have regarding this notification. 

• Automatic Identity Protection, effective May 12, 2017 that includes $25,000 of identity insurance 
and unlimited access to Identity Fraud Inc. certified fraud resolution specialists to help resolve 
any type of identity theft or fraud, whether arising from this incident or that may arise from 
unrelated events. 

• One year of credit monitoring. In order to enroll in credit monitoring, you will need to go to 
https://mv.identitvfraud.com/enrollment within 90 days and provide the following code: «Code». 

Please know that the protection and security of your personal information is our highest priority, and we 
sincerely regret this incident and any inconvenience or concern this matter may cause you. If you have 
any questions about this notice, please do not hesitate to contact me. 


Sincerely, 


James ^ (JiCreath, Jr. 


James R. Gilreath, Jr. 

Rose Harrison & Gilreath, P.C. 



Additional Important Information 


For residents of Hawaii , Michigan , Missouri , Virginia , Vermont , and North Carolina: It is recommended by state law that you remain 
vigilant for incidents of fraud and identity theft by reviewing credit card account statements and monitoring your credit report for 
unauthorized activity. 


For residents of Illinois , Iowa , Maryland , Missouri , North Carolina , Oregon , and West Virginia: 

It is required by state laws to inform you that you may obtain a copy of your credit report, free of charge, whether or not you suspect any 
unauthorized activity on your account. You may obtain a free copy of your credit report from each of the nationwide three credit reporting 
agencies. To order your free credit report, please visit www.annualcreditreport.com , or call toll-free at 1-877-322-8228. You can also order 
your annual free credit report by mailing a completed Annual Credit Report Request Form (you can find the form at 
https://www.consumer.ftc.gov/articles/Q155-free-credit-reports ) to: Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA, 
30348-5281. 

For residents of Iowa: 

State law advises you to report any suspected identity theft to law enforcement or to the Attorney General. 

For residents of Oregon: 

State laws advise you to report any suspected identity theft to law enforcement, including the Attorney General, and the Federal Trade 
Commission. 


For residents of Maryland, Rhode Island , Illinois , and North Carolina: 

You can obtain information from the Maryland and North Carolina Offices of the Attorneys General and the Federal Trade Commission about 
fraud alerts, security freezes, and steps you can take toward preventing identity theft. 


Maryland Office of the 
Attorney General 

Consumer Protection Division 
200 St. Paul Place 
Baltimore, MD 21202 
1-888-743-0023 
www.oag.state.md.us 


Rhode Island Office of the 
Attorney General 

Consumer Protection 
150 South Main Street 
Providence RI02903 
1-401-274-4400 
www.riag.ri.gov 


North Carolina Office of the 
Attorney General 

Consumer Protection Division 
9001 Mail Service Center 
Raleigh, NC 27699-9001 
1-877-566-7226 
www.ncdoj.com 


Federal Trade Commission 

Consumer Response Center 
600 Pennsylvania Ave, NW 
Washington, DC 20580 
1-877-IDTHEFT (438-4338) 
www.ftc.gov/bcp/edu/microsit 
es/idtheft 


For residents of Massachusetts : 

It is required by state law that you are informed of your right to obtain a police report if you are a victim of identity theft 


For residents of all states: 

Fraud Alerts: You can place fraud alerts with the three credit bureaus at one of the three major credit bureaus by phone and also via Experian’s 
or Equifax’s website. A fraud alert tells creditors to follow certain procedures, including contacting you, before they open any new accounts or 
change your existing accounts. For that reason, placing a fraud alert can protect you, but also may delay you when you seek to obtain credit. The 
contact information for all three credit bureaus is below: 


Monitoring: You should always remain vigilant and monitor your accounts for suspicious or unusual activity. 

Security Freeze: You also have the right to place a security freeze on your credit report. A security freeze is intended to prevent credit, loans 
and services from being approved in your name without your consent. To place a security freeze on your credit report, you need to make a 
request to each consumer reporting agency. You may make that request by certified mail, overnight mail, or regular stamped mail, or by 
following the instructions found at the websites listed below. The following information must be included when requesting a security freeze (note 
that if you are requesting a credit report for your spouse, this information must be provided for him/her as well): (1) full name, with middle initial 
and any suffixes; (2) Social Security number; (3) date of birth; (4) current address and any previous addresses for the past five years; and (5) any 
applicable incident report or complaint with a law enforcement agency or the Registry of Motor Vehicles. The request must also include a copy 
of a government-issued identification card and a copy of a recent utility bill or bank or insurance statement. It is essential that each copy be 
legible, display your name and current mailing address, and the date of issue. The consumer reporting agency may charge a small fee to place, 
life, or remove a freeze, but is free if you are a victim of identity theft or the spouse of a victim of identity theft, and you have submitted a valid 
police report relating to the identity theft incident to the consumer reporting agency. You may obtain a security freeze by contacting any one or 
more of the following national consumer reporting agencies: 


Equifax Security Freeze 

P.O. Box 105788 
Atlanta, GA 30348 
www.freeze.equifax.com 

800-525-6285 


Experian Security Freeze 

P.O. Box 9554 

Allen, TX 75013 

www.experian.com/freeze 

888-397-3742 


TransUnion (FVAD) 

P.O. Box 2000 

Chester, PA 19022 

https://www.transunion.com/credit- 

freeze/place-credit-freeze 

888-680-7289 


More information can also be obtained by contacting the Federal Trade Commission listed above. 
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